1. 창 병 모 숙명여대 전산학과 http://cs.sookmyung.ac.kr/~chang
자바 언어를 위한 정적 분석 (Static Analyses for Java) ‘99 한국정보과학회 가을학술발표회 튜토리얼
창 병 모
숙명여대 전산학과
'99 정보과학회 튜토리얼

2. 목차 Java Overview Why static analyses ? Static analyses Conclusions
Class analysis
Exception analysis
Escape analysis
Conclusions
'99 정보과학회 튜토리얼

3. Java overview Object oriented C-like syntax Static typing
classes (single inheritance)
object types (interfaces)
objects
C-like syntax
Static typing
type soundness by Eisenbach in ECOOP’97
by Nipkow in ACM POPL’98
'99 정보과학회 튜토리얼

4. Java overview Dynamic binding Exception handling
inheritance and overriding
class analysis (object type inference)
Exception handling
uncaught exception analysis
Automatic memory management
escape analysis
Concurrency
'99 정보과학회 튜토리얼

5. Why Static Analyses for Java
Class analysis
for call graph and fast method dispatch in compiler
Exception analysis
for verification and programming environments
Escape analysis
for efficient memory management and synchronization optimization
'99 정보과학회 튜토리얼

6. Higher-order CFA and Class Analyses
'99 정보과학회 튜토리얼

7. Higher-order Flow Analysis
Call graphs
Many program analyses rely on a call-graph.
There is an edge (f,g) if function f calls function g.
Call graphs are easy to compute in FORTRAN.
Not so easy in higher-order languages
functional (ML)
object-oriented (Java, C++)
pointer-based (C)
'99 정보과학회 튜토리얼

8. Higher-order Flow Analysis
In a functional language
e1 e2 closure analysis [Shivers88]
In an object oriented language
e.m() class analysis
In a pointer language
(*p)() pointer analysis
In each case it is unclear which function is called.
'99 정보과학회 튜토리얼

9. Class Analyses for Java
The goal is
to approximate the classes of the objects, to which an expression refer
Also gives an approximation of the call graph
'99 정보과학회 튜토리얼

10. Class Analyses for Java
Domain
Sets of class names.
A set variable [e] for each expression e.
Set up set-constraints of the form :
[e] Ê se
Analysis assigns possible classes of e to [e].
Solution of the constraints yield the information
'99 정보과학회 튜토리얼

11. Sample Constraints for Class Analyses
Suppose e is each of the following expressions
new C | [e] Ê {C}
if e0 then e1 else e2 | [e] Ê [e1] È [e2]
id = e1 | [id] Ê [e1]
Method application e0.m(e1)
for each class C in [e0] with a method m(x1) = return em
C Î [e0] Þ ([x1] Ê [e1])
[e] Ê [em]
'99 정보과학회 튜토리얼

12. History in Class Analyses
Constraint resolution in O(n3 ) time.
This analysis was discovered
by Palsberg and Schwartzbach in 1991.
closely related to closure analysis for functional programs (Jones,Shivers).
Fast interprocedural class analysis
by node(set variable) merging
Grove and Chambers in ACM POPL’98
'99 정보과학회 튜토리얼

13. Objects and Methods in Java
class C {
int n;
void incr() { n++; }
void decr() { n--; } }
Method invocation:
[[e.m(arg)]] =
object * o = [[e]]; lookup(o®vtable, m)(o, [[arg]])
method table
void C::incr(this)
{ this.n++; g}
object
incr
decr
Value of n
void C::decr(this)
{ this.n--; }
'99 정보과학회 튜토리얼

14. Objects and Methods in Java
Layout of method tables attached to objects
based on inheritance hierarchies
Transformation of method invocations into
method lookups + calls.
We can generate a direct call c.m using analysis
if that set is a singleton {c} or
if all elements in that set have the same implementation of method m
'99 정보과학회 튜토리얼

15. Uncaught Exception Analysis
'99 정보과학회 튜토리얼

16. Exceptions in Java Every exception is declared as Throw exceptions
a subclass of “Exception” class
Throw exceptions
throw e
Exception handling
try { … } catch (E x) { … }
Specify uncaught exceptions in method definition
m(...) throws … { …}
'99 정보과학회 튜토리얼

17. Uncaught Exception Analysis in JDK
Intraprocedural analysis
Based on programmer’s specifications.
Not elaborate enough to
suggest for specialized handling nor
remove unnecessary handlers
'99 정보과학회 튜토리얼

18. Uncaught Exception Analysis
We need an interprocedural analysis to
estimate Java program's exception flows
independently of the programmer's specs.
Approximate all possible uncaught exceptions
for every expression and every method
Exception analysis after class analysis
'99 정보과학회 튜토리얼

19. Deriving Set Constraints
Domain
Sets of exception class names.
A set variable Pe for every expression e
Deriving set constraints of the form :
Pe Ê se
Analysis assigns classes of possible uncaught exceptions of e to Pe
'99 정보과학회 튜토리얼

20. Deriving Set Constraints
Suppose e is each of the following expressions
id = e1 | Pe Ê Pe1
if e0 then e1 else e2 | Pe Ê Pe0 È Pe1 È Pe2
throw e1 | Pe Ê [e1] È Pe1
try e0 catch (c1 x1 ) e1 | Pe Ê (Pe0 - {c1}*) È Pe1
Method invocation e0.m(e1)
- Pe Ê Pe0 È Pe1
- for each class C in [e0] with a method m(x1) = em
C Î [e0 ] Þ Pe Ê Pem
'99 정보과학회 튜토리얼

21. Method-level Exception Analysis
Cost-Effective?
Too Many Set Variables
Observations
exceptions are sparse objects
exceptions are usually explicit
methods are usually explicit
'99 정보과학회 튜토리얼

22. Set Variables for Method-level Analysis
Pf for each method f
class names of uncaught exceptions during the call to f
Pg for try expressions eg in
try eg catch (c1 x1) e1
Assume that [e] represents
classes that are ``available'' at an expression e
'99 정보과학회 튜토리얼

23. Method-level Set Constraints
Suppose each expression is in a method f
id = e1 |
if e0 then e1 else e2 |
throw e1 | Pf Ê [e1] Ç ExnClasses
try eg catch (c1 x1) e1 | Pf Ê Pg - {c1}*
Method invocation e0.m(e1)
- for each class C in [e0] with a method m(x1) = em
C Î [e0] Þ Pf Ê Pc.m
'99 정보과학회 튜토리얼

24. Exception Analyses for Java
Exception analysis for Java
by Yi and Chang in ECOOP’99 Workshop
Expression-level and Method-level
We are currently devising
a general framework for method-level analysis
Jex
A tool for a view of the exception flow
by Robillard and Murphy in 1999
'99 정보과학회 튜토리얼

25. Applications of Exception Analysis
A kind of program verification
Provide programmers information on all possible uncaught exceptions
Can be incorporated in Java programming environment
'99 정보과학회 튜토리얼

26. Escape Analysis
'99 정보과학회 튜토리얼

27. Escape Analysis Escape analysis is basically
lifetime analysis of objects
An object escapes a method if it is
passed as a parameter
returned
Basic idea of applications:
Basically all objects are allocated in a heap.
If an object doesn’t escape a method(or region), it can be allocated on stack
'99 정보과학회 튜토리얼

28. Escape Graph for Escape Analysis
inside node
object created inside the currently analyzed region and accessed via inside edges.
outside node
object created outside the currently analyzed region or accessed via outside edges.
inside edge
references created inside the current region
outside edge
references created outside the current region
'99 정보과학회 튜토리얼

29. Example Class complex { double x, y;
complex (double a, double b) { x = a; y = b;}
complex multiply(complex a) {
complex product = new complex(x*a.x - y*a.y, x*a.y+y*a.x);
return product; }
complex add(complex a) {
complex sum = new complex(x+a.x,y+a.y);
return sum;
complex multiplyAdd(complex a, complex b) {
complex product = a.multiply(b);
complex sum = this.add(product);
'99 정보과학회 튜토리얼

30. Example Analysis Result for mutiplyAdd a b this product sum
Inside edge
Outside edge
Inside node
Outside node
Return value
'99 정보과학회 튜토리얼

31. Escape Analysis Intraprocedural analysis Interprocedural analysis
Construction of escape graph following the control-flow
Interprocedural analysis
For every method invocation cite, mapping between caller and callee.
To simulate parameter passing and returning
'99 정보과학회 튜토리얼

32. Escape Analysis OOPSLA’99
Compositional Pointer and Escape Analysis for Java Programs by J. Whaley and M. Rinard
Escape analysis for object-oriented languages: application to Java by B Blanchet
Escape analysis for Java by J.D. Choi et al.
'99 정보과학회 튜토리얼

33. Conclusions We surveyed three major analyses for Java
class analysis, exception analysis, escape analysis
Further research topics
generalize method-level analysis
static analysis in connection with verification
analyses of Java bytecode
'99 정보과학회 튜토리얼